Heimdal is an implementation of Kerberos 5, largely written in Sweden
(due to crypto export legal issues in the US at the time). It is freely
available under a three clause BSD style license.
===> The following configuration options are available for heimdal-devel-2023.11.29_1:
BDB=on: Enable BerkeleyDB KDC backend support
CRACKLIB=off: Use CrackLib for password quality checking
DIGEST=on: Enable DIGEST support
IPV6=on: IPv6 protocol support
KX509=on: Enable kx509 support
LDAP=off: Enable OpenLDAP KDC backend support
LMDB=off: Enable LMDB KDC backend support
MICROHTTPD=off: Add microhttpd support
PKINIT=on: Enable PK-INIT support
SQLITE=off: Enable SQLite KDC backend support
===> Use 'make config' to modify these settings
heimdal-7.1.0_1 uses a new database format which is incompatible
with Heimdal in the base system and heimdal-1.5.3_6 or prior.
Please read 20161112 in /usr/ports/UPDATING carefully to upgrade
your database.
security/heimdal-devel: fix with stock clang and lld >= 16
Upstream clang >= 16 made -Wimplicit-function-declaration into an error
by default. In the base system, this change was reverted to reduce the
fallout in ports, because there are many problematic configure scripts.
For security/heimdal-devel this also applies, so for building the port
with devel/llvm16 or higher we need to add
-Wno-implicit-function-declaration to CFLAGS.
Additionally, similar to bug 275979, add -Wl,--undefined-version to
LDFLAGS, to suppress any linker errors about missing versioned symbols.
PR: 283132
Approved by: cy (maintainer)
MFH: 2024Q4
Mk/**ldap.mk: Convert USE_LDAP to USES=ldap
Convert the USE_LDAP=yes to USES=ldap and adds the following features:
- Adds the argument USES=ldap:server to add openldap2{4|5|6}-server as
RUN_DEPENDS
- Adds the argument USES=ldap<version> and replaces WANT_OPENLDAP_VER
- Adds OPENLDAP versions in bsd.default-versions.mk
- Adds USE_OPENLDAP/WANT_OPENLDAP_VER in Mk/bsd.sanity.mk
- Changes consumers to use the features
Reviewed by: delphij
Approved by: portmgr
Differential Revision: https://reviews.freebsd.org/D38233
Partially revert "security/heimdal*: Remove LLVM_DEFAULT build prerequisite"
The suggested workaround will only work when autoreconf is not run.
The devel port still needs LLVM_DEFAULT while the non-devel port does
not
PR: 267814
Fixes: 22a683a337ef
MFH: 2022Q4
This partially reverts commit 22a683a337efe7169b61de8c9ec63e2c0d561891.
security/heimdal*: Handle other types of garbage data
In addition to garbage realm data, also handle garbage dbname, acl_file,
stash_file, and invalid bitmask garbage data.
PR: 267912
Reported by: Robert Morris <rtm@lcs.mit.edu>
MFH: 2022Q4
security/heimdal*: Fix NULL dereference when mangled realm message
Fix a NULL dereference in _kadm5_s_init_context() when the client
sends a mangled realm message.
PR: 267912
Reported by: Robert Morris <rtm@lcs.mit.edu>
MFH: 2022Q4
security/heimdal*: The version string must always contain a terminating NUL
Should the sender send a string without a terminating NUL, ensure that
the NUL terminates the string regardless.
And while at it only process the version string when bytes are returned.
PR: 267884
Reported by: Robert Morris <rtm@lcs.mit.edu>
MFH: 2022Q4
security/heimdal*: Remove LLVM_DEFAULT build prerequisite
Adjust ./configure to set the correct CLANG_FORMAT value when
clang-format is not found (when none of the llvm ports are installed).
PR: 267814
Submitted by: Tatsuki Makino <tatsuki_makino@hotmail.com>
MFH: 2022Q4
security/heimdal*: Remove lockfile dependency
Though heimdal ./configure checks for a lockfile dependency, it does
not use it. Let's remove the dependency.
PR: 267814
Reported by: Tatsuki Makino <tatsuki_makino@hotmail.com>
MFH: 2022Q4
security/heimdal-devel: Add MICROHTTPD option
Add MICROHTTPD option to support httpd access to the KDC. This option is
not enabled by default since this adds another vector of compromise.
security/heimdal-devel: Fix configure and package
Remove libmicrohttpd support. If installed it will automatically detect
and build the necessary binaries to support a microhttpd KDC server.
It is felt that a KDC with httpd support is another vector of concern.
Fixes: 4e44a84dcc9a
security/heimdal-devel: New port tracking Heimdal develpment
This new heimdal port tracks the Heimdal development branch. The
last security advisory showed us we might want to track its development.
